Wednesday, October 09, 2013

Plain View, Computer Forensics and Rosetta Stone

As this press release
from the U.S. Attorney for the Northern District of Georgia explains, on August
2, 2011 Carl Skow, of Marietta, Georgia, was indicted on federal charges of

attempting to obtain a minor for
the purpose of engaging in a commercial sex act, enticement of a minor to
engage in sexual activity, and possession of child pornography. . . . In
June 2011, an undercover federal agent responded to an ad posted by Skow on an
online classifieds website in which he offered a younger girl sex for money.

Between early June 2011 and July
6, 2011, Skow and the agent communicated several times through electronic mail,
by telephone, and in person, regarding [his] interest in purchasing a minor
female from Guatemala for sexual services. Skow agreed to pay the agent $2,500
for a year of her services and made a down payment of $1,250. . . . The agent
and Skow agreed to meet at Hartsfield-Jackson International Airport on July 6,
2011, where SKOW planned to pick up the minor female, and make the final $1,250
payment to the undercover agent.

On that day at the agreed meeting
location, Skow was arrested in possession of the final payment. Also on
July 6, agents executed a search warrant at [his] home and found, among other
items, numerous images of child pornography on Skow’s home computer.

This post examines a recent opinion in which the
federal district court judge who has the case ruled on Skow’s motion to
suppress certain evidence.U.S. v. Skow, 2013 WL 5493308 (U.S.District Court for the Northern District of Georgia 2013). As to how the motion arose, the judge
explained, in an earlier opinion, that

Agent Tad G. Schlatre presented a
search warrant application to Judge Linda T. Walker on July 6, 2011, seeking a
warrant to search [Skow’s] residence at 502 Olde Mill Lane in Norcross,
Georgia, to include a search of computer storage media and other items
specified in the application. . . . The warrant application recited
that it was seeking evidence of the violation of 18 U.S. Code § 2422(b),
which makes it a crime to persuade, induce, entice, or coerce a minor to engage
in prostitution or any other criminal sexual activity, or attempt to do
so. . . .

Judge Walker signed the warrant,
which was executed by law enforcement at [Skow’s] residence at about the same
time [he] was being arrested at the Atlanta Airport when he showed up for a
meeting with an undercover agent.

U.S.
v. Skow, 2012 WL 4514282 (U.S. District Court for the
Northern District of Georgia 2012) (“U.S.
v. Skow 2012”).

In the opinion this post examines, the district court
judge adopts the “report and recommendation” a U.S. Magistrate Judge wrote
analyzing Skow’s argument in his motion to suppress.As Wikipedia explains, a U.S. District Court
judge can assign a Magistrate Judge to write a “Report and Recommendation” on a
legal issue and submit it to the District Court Judge, who accepts it as
written, rejects it or ask that it be revised.

The issue the Magistrate Judge analyzes is whether,

under the plain view doctrine,
during the search of [Skow’s] computer undertaken pursuant to a warrant, the
officers were lawfully in a place where the incriminating or evidentiary
character of the images of child pornography would have been `immediately
apparent,’ assuming that the officers were not authorized by probable cause
under the warrant to search for child pornography.

U.S.
v. Skow, supra.

As Wikipedia explains, and as I have noted in priorposts, the plain view doctrine is a principle that can expand the scope of a
lawful 4th Amendment search, i.e., a search conducted pursuant to a
valid search warrant.It lets, as
Wikipedia notes, an officer seize evidence found during a lawful 4th
Amendment search if (i) the officer does not violate the 4th
Amendment by being at the police where he/she saw the evidence, (ii) the
officer does not violate the 4th Amendment by accessing and seizing
the evidence and (iii) the incriminating nature of the item(s) is “immediately
apparent” to the officer.

At the hearing on Skow’s motion to suppress, two of the
agents who participated in the investigation testified about the process used
to search Skow’s computer.Schlatre did
not perform the forensic analysis of the computer, but was the affiant on the
application for the search warrant and testified how agents, “generally
speaking,” would go about

searching for the evidence or items
listed in the warrant. . . . [He] testified that they were looking for evidence
on the computer of who owned the computer, which could include resumés, photos
of the owner, or other similar identifying information. . . . He would also
look for Skype or instant messaging, and also for photographs that would
indicate ownership of the computer. . . .To find photos of the owner, the
examiner would need to look at all the photographs on the computer. . . .

In addition, . . . the agents were looking for
evidence of purchase of a copy of any `Rosetta Stone’ language courses or
materials. . . . To look for this evidence, agents would use a keyword search. .
. . Alternatively, agents could look for a logo for Rosetta Stone or a picture
of the packaging indicating that someone went to a website for it. . . .Examiners
would look in different places in the computer for any such evidence. . . .

The warrant also authorized a search for evidence of
the purchase of a girl's bicycle as a means of transportation for a teenage
girl. . . . Insofar as the warrant authorized search for `[a]ny evidence of
preparation for the arrival of a 14–year–old female, including[,] but not
limited to, girl's clothing, beds, toys, games,’ . . . the agent would do word
searches for these items and also look for pictures of toys and games. . .

The warrant also authorized a search
for certain photographs of minor girls provided by the undercover agent to [Skow].
. . . Again, the agent testified that the examiner could be expected to do a
keyword search for the particular e-mail account that the pictures were sent
to. . . . would also look in the internet cache or in slack space, but
ultimately would have to look at all the pictures on the computer to find them.
. . .

U.S.
v. Skow, supra.

Agent Michael Richardson, who examined Skow’s computer,
testified that he used

`Encase Portable.’ . . . After
performing several operations on the computer and hard drives over a two-hour
period, he received a manageable `bucket of images’ to look at. . . . He
immediately noticed . . .child pornography. . . . At that point he just shut
the preview down because they were seizing the computers anyway. . . .

Back at the lab, he also used another version of
Encase. . . . He looked at [the] . . . `bucket of images.’ . . . He was also
looking for images of `Mariena,’ a 14-year-old girl whose name he had been
given. . . . Scrolling through the images he ultimately found images of
Mariena. . . .Those images were later `hashed’ and found to be the same images
sent by the undercover agent to [Skow]. . . .

He also found evidence of Rosetta Stone through a
keyword search which took him directly to it. . . . With regard to the girls'
bicycles, he did image searching and a keyword search. . . . He did not find
anything. . . . With regard to evidence of `preparation for the arrival of a
14–year–old female,’ he went through images to see if there were any images of
any of these items. . . . He also did keyword searches and again checked the
Internet history and found no evidence of those items either. . . .

Richardson was looking for child pornography because
he believed the warrant authorized him to do that. . . . [I]f he had
just been looking for photographs of Mariena when he searched under the search
warrant he would not have done anything differently. . . . And with regard to
Rosetta Stone, the bicycle, the children's clothing, the evidence of usership,
he would have scrolled through all the images. . . .

U.S.
v. Skow, supra.

Jim Persinger is a computer forensics consultant Skow hired.
U.S. v. Skow, supra.
He examined Skow’s computer in an office at the Department of Homeland
Security. U.S. v. Skow, supra.He started with hash values but “also did a
keyword search for `Mariena.’” U.S. v.
Skow, supra.Persinger “used a
function called Gallery Viewer”, which “turned up images of the pictures in
question.” U.S. v. Skow, supra.“It
did not turn up any child pornography” but Persinger “found the term `Rosetta.’”
U.S. v. Skow, supra.

In his opinion, someone who found child pornography
on this computer had to be

zeroing in and looking
particularly for child pornography, not looking for Rosetta Stone, or
references to a girl's bicycle, or the five particular photographs. . . . He
was asked to perform particular tasks. To find the three to five pictures and
references to Rosetta Stone, he focused on two hard drives. . . . He was not
asked to look for references to bicycles or evidence of shopping for children's
clothing or toys. . . .

He said that if he had been asked to look for
information regarding a girl's bicycle or women's clothes he would have said
the search was too broad. . . . He agreed that once he found what he thought
was a picture, ultimately he would have to open the picture and look at it to
be sure it was what he was looking for. . . .

He
was shown the last page of [Skow’s] Exhibit 1, page 17, an exhibit created by
him. . . . [H]is attention was called to a file labeled as
follows, in part: `Guatemala 9yo fucked in car with sound.mpg.lnk.’ . . .That
file was found on [Skow’s] computer on a hard drive. . . . In fact, he found
this in the course of his examination. . . .

He admitted that if he was
looking for evidence of [Skow’s] preparation to bring a young Guatemalan girl
into his home for sex he would search `Guatemala.’ . . . If he did that, this file would come up. . . .
He could then play the video and determine whether, as the title suggests, it
showed a 9–year–old Guatemalan girl being raped. . . . He admitted that if he had gone as far as to
find this link he would have had reason to believe that the link was
pornographic in nature and involved a child. . . .

U.S.
v. Skow, supra.

In his motion to suppress, Skow argued that

a properly limited search using
hash values and keywords would have immediately disclosed the pictures of the
young girls given to [him] by the undercover officer, any reference to a girl
named `Mariena,’ any reference to Rosetta Stone language courses, and any
indicators of ownership of the computer, without ever placing the examining
agents in a place where they would have seen child pornography.

U.S.
v. Skow, supra.He also
argued that “a limitation of the search to evidence received or created
after June 3, 2011, would likewise have assured that no child pornography would
have been seen.” U.S. v. Skow,
supra.

-->

In his Report and Recommendation, the Magistrate
Judge noted, first, that “even though [Skow] is correct that it would have been
possible to target narrowly the girl photographs, and the references to Rosetta
Stone and Mariena, without necessarily having ventured into a place on the
computer where child pornography could have been discovered,” his argument “fails
as it is applied to other categories of information authorized to be searched
for and seized in the warrant.”U.S. v. Skow, supra.He also noted that the "warrant authorized search for any evidence of the purchase of a bicycle [and] for any evidence of preparation for and arrival of a 14–year–old female, probably from Guatemala” and said he could not “conclude it was unreasonable for Richardson to have looked through his
`bucket of images’ seeking such evidence.” U.S.
v. Skow, supra.

And he noted Persinger said that, under the circumstances, he “himself would have retrieved
the file described above and would have recognized it as a link to child pornography.”
U.S. v. Skow, supra. He did not
find Richardson’s actions in this regard to violate the 4th
Amendment’s requirement of “reasonableness.” U.S. v. Skow, supra.

As to the date limitation Skow suggested, the
Magistrate Judge found that “given that the preview software used on the scene
by Richardson lacked the capability of date limitation, . . . it
was not unreasonable for [him] to have reviewed the images on site without
applying such a limitation.” U.S. v.
Skow, supra. As to “the more comprehensive search performed back at the
lab,” he did not find “any unreasonable conduct in the agents looking at the
list of files and at least cursorily opening those that appeared to be
evidentiary or contraband.”U.S. v. Skow, supra. As the Magistrate
Judge noted, when an officer has a lawful warrant that authorizes him/her to
search for and seize evidence, he/she can look wherever the evidence could be. U.S. v. Skow, supra.

As to the general scope of the search, the
Magistrate Judge found that whether it would

have been reasonable to have
looked through all the jpegs and other photographic image files just to find
the pictures of the girls, or a reference to Rosetta Stone, it was certainly
reasonable for the agent to look through [Skow’s]photographs for evidence of [his]
ownership, possession and control of the computer and its hard drives, and it
was reasonable to look for any evidence of [his] planning and preparations for
the coming of this Guatemalan girl he believed the undercover officer was going
to deliver to him. And, as Richardson testified, as soon as he started looking
through the images on [Skow’s] computer, he came very quickly in the process
upon child pornography.

U.S.
v. Skow, supra.

The judge therefore held that the fact Richardson
was

looking for child pornography
does not render his search unconstitutional. At the time he made his search, he
was possessed of a search warrant that, on its face, authorized him to search
for child pornography. The issue is not whether he was looking for child
pornography.

The issue is whether the search
warrant authorized the agent to look through the photographs in making the
searches he had probable cause to make, and whether, in so carrying out this
authorized mandate, the agent came into a place where photographs would have
been in plain view whose incriminating character as child pornography would
have been `immediately apparent.’ I answer these questions, `Yes.’ I thus conclude on this issue that the
requirements of the plain view doctrine were met in this case with regard to
Richardson's discovery of child pornography on [Skow’s] computer and its
associated hard drives.

U.S.
v. Skow, supra.

The Magistrate Judge therefore recommended that
Skow’s motion to suppress should be denied.U.S. v. Skow, supra.The U.S. District Court Judge who has the
case later adopted the Magistrate Judge’s Report and Recommendation as his
opinion, which meant he denied Skow’s motion to suppress.U.S. v.
Skow, supra.

1 comment:

Anonymous
said...

I know the subject matter is disturbing, but does anyone else see this decision as quite disturbing as well? There is a pretty serious factual issue (Encase portable can apply date filters for one, after a 30 second Google Search). The magistate credited that it couldn't?

The other glaring issue is that agents given a warrant for toys, bicycles and bedding can look on a computer, evidently any way they choose? They can also search every picture of media inside of a home just to show ownership? Yikes, glad I'm not studying in that district. Why even have the particularity standard if these searches are allowable? Porn cases make such bad computer search law.